CVE Vulnerability Advisory Database

[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions

[Impact] Remote, unauthenticated attackers can inject arbitrary SQL queries, manipulate the database, and gain full administrator access to the Metabase instance

[Mitigation] Apply the official vendor security patches immediately, or restrict access to the vulnerable endpoint using a WAF or reverse proxy

[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2

[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules

[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)

[Impact] Successful exploitation allows remote attackers to execute arbitrary SQL commands and retrieve sensitive database information when a plugin or theme passes untrusted input to the 'author__not_in' parameter of WP_Query.

[Mitigation] Immediately upgrade WordPress core to the patched versions (6.8.6, 6.9.5, or 7.0.2) and apply WAF filtering rules.

[Affected Scope] Sangoma Switchvox SMB Edition 8.3 (104997) and prior versions

[Impact] An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database, leading to full database compromise and remote code execution (RCE)

[Mitigation] Immediately upgrade to Switchvox version 8.4.0.2 or later, and restrict external access to the /pa endpoint

[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).

[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7

[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials

[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim

[Affected Scope] Fortinet FortiClientEMS version 7.4.4

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges by sending crafted HTTP requests.

[Mitigation] Immediately apply the official vendor patches and restrict external access to the EMS management ports.